0e27d7da3ba5c91d4b39587539428a047b2001c4c9fc3ec3a6142bc2e225b557

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe
Size 2.7MB
Sample260718-bt52qsby2q
SHA256 0e27d7da3ba5c91d4b39587539428a047b2001c4c9fc3ec3a6142bc2e225b557
MD5 f5e79ebf66ad740156da54a461b082fb
SHA1 db13a66eadb592443aab8ddda0285be0d3dc2d9a
SHA512 0c6abf10dfcbe0fa2855cd2631e29acab037e4451aed05115b22e34e4809968e228c0f42720203b84e40085817730d615ffd50cc1c8f71f87c6f3c6529bee3d4
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3G:CebAjOKn3wRKRJ3G
TLSH
T1F9D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-hub\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification-shared\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_910700835\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-hub\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Wallet-Checkout\load-ec-deps.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-mobile-hub\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Notification\notification_fast.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\wallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-ec\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_910700835\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_910700835\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-ec\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Notification\notification_fast.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-hub\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\wallet-icon.svg	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\wallet-webui-708.de49febeeb0e9c77883f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_910700835\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_910700835\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-ec\pt-PT\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288116409411819"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{8C7D37BF-6820-4BCE-B3FB-CF74B2674C3F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1644	wmic.exe
1644	wmic.exe
1644	wmic.exe
1644	wmic.exe
7016	msedge.exe
7016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2032	2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1644	wmic.exe
Token: SeSecurityPrivilege	1644	wmic.exe
Token: SeTakeOwnershipPrivilege	1644	wmic.exe
Token: SeLoadDriverPrivilege	1644	wmic.exe
Token: SeSystemProfilePrivilege	1644	wmic.exe
Token: SeSystemtimePrivilege	1644	wmic.exe
Token: SeProfSingleProcessPrivilege	1644	wmic.exe
Token: SeIncBasePriorityPrivilege	1644	wmic.exe
Token: SeCreatePagefilePrivilege	1644	wmic.exe
Token: SeBackupPrivilege	1644	wmic.exe
Token: SeRestorePrivilege	1644	wmic.exe
Token: SeShutdownPrivilege	1644	wmic.exe
Token: SeDebugPrivilege	1644	wmic.exe
Token: SeSystemEnvironmentPrivilege	1644	wmic.exe
Token: SeRemoteShutdownPrivilege	1644	wmic.exe
Token: SeUndockPrivilege	1644	wmic.exe
Token: SeManageVolumePrivilege	1644	wmic.exe
Token: 33	1644	wmic.exe
Token: 34	1644	wmic.exe
Token: 35	1644	wmic.exe
Token: 36	1644	wmic.exe
Token: SeIncreaseQuotaPrivilege	1644	wmic.exe
Token: SeSecurityPrivilege	1644	wmic.exe
Token: SeTakeOwnershipPrivilege	1644	wmic.exe
Token: SeLoadDriverPrivilege	1644	wmic.exe
Token: SeSystemProfilePrivilege	1644	wmic.exe
Token: SeSystemtimePrivilege	1644	wmic.exe
Token: SeProfSingleProcessPrivilege	1644	wmic.exe
Token: SeIncBasePriorityPrivilege	1644	wmic.exe
Token: SeCreatePagefilePrivilege	1644	wmic.exe
Token: SeBackupPrivilege	1644	wmic.exe
Token: SeRestorePrivilege	1644	wmic.exe
Token: SeShutdownPrivilege	1644	wmic.exe
Token: SeDebugPrivilege	1644	wmic.exe
Token: SeSystemEnvironmentPrivilege	1644	wmic.exe
Token: SeRemoteShutdownPrivilege	1644	wmic.exe
Token: SeUndockPrivilege	1644	wmic.exe
Token: SeManageVolumePrivilege	1644	wmic.exe
Token: 33	1644	wmic.exe
Token: 34	1644	wmic.exe
Token: 35	1644	wmic.exe
Token: 36	1644	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 6168	2032	2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe	90
PID 2032 wrote to memory of 2708	2032	2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe	92
PID 2708 wrote to memory of 3352	2708	msedge.exe	93
PID 2708 wrote to memory of 752	2708	msedge.exe	94
PID 2708 wrote to memory of 4852	2708	msedge.exe	95
PID 2708 wrote to memory of 752	2708	msedge.exe	94
PID 2708 wrote to memory of 752	2708	msedge.exe	94
PID 2708 wrote to memory of 6360	2708	msedge.exe	96
PID 2708 wrote to memory of 6360	2708	msedge.exe	96
PID 2708 wrote to memory of 4520	2708	msedge.exe	97
PID 2708 wrote to memory of 6732	2708	msedge.exe	98
PID 2708 wrote to memory of 4520	2708	msedge.exe	97
PID 2708 wrote to memory of 4520	2708	msedge.exe	97
PID 2708 wrote to memory of 6732	2708	msedge.exe	98
PID 2708 wrote to memory of 6732	2708	msedge.exe	98
PID 2708 wrote to memory of 6464	2708	msedge.exe	100
PID 2708 wrote to memory of 6464	2708	msedge.exe	100
PID 2708 wrote to memory of 6464	2708	msedge.exe	100
PID 2708 wrote to memory of 4728	2708	msedge.exe	101
PID 2708 wrote to memory of 4728	2708	msedge.exe	101
PID 2708 wrote to memory of 4728	2708	msedge.exe	101
PID 2708 wrote to memory of 1388	2708	msedge.exe	103
PID 2708 wrote to memory of 5824	2708	msedge.exe	102
PID 2708 wrote to memory of 1388	2708	msedge.exe	103
PID 2708 wrote to memory of 5824	2708	msedge.exe	102
PID 2708 wrote to memory of 5808	2708	msedge.exe	105
PID 2032 wrote to memory of 1644	2032	2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe	108
PID 2708 wrote to memory of 1772	2708	msedge.exe	112
PID 2708 wrote to memory of 5688	2708	msedge.exe	113
PID 2708 wrote to memory of 4104	2708	msedge.exe	114
PID 2032 wrote to memory of 5392	2032	2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe	115
PID 2708 wrote to memory of 5616	2708	msedge.exe	117
PID 2708 wrote to memory of 5616	2708	msedge.exe	117
PID 2708 wrote to memory of 1136	2708	msedge.exe	120
PID 2708 wrote to memory of 1136	2708	msedge.exe	120
PID 2708 wrote to memory of 7068	2708	msedge.exe	121
PID 2708 wrote to memory of 7068	2708	msedge.exe	121
PID 2032 wrote to memory of 1940	2032	2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe	122
PID 2708 wrote to memory of 7016	2708	msedge.exe	124
PID 2708 wrote to memory of 2472	2708	msedge.exe	125
PID 2708 wrote to memory of 2472	2708	msedge.exe	125

Views/modifies file attributes 1 TTPs 3 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6168	attrib.exe
5392	attrib.exe
1940	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.old_1784338036
  2⤵
  - Views/modifies file attributes
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff983d4c188,0x7ff983d4c194,0x7ff983d4c1a0
    3⤵
    PID:3352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,14903750292045211439,8614291642335227711,262144 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12232740254115671246,4936533747489998281,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,18368937015446902275,8051459014491636850,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
    3⤵
    PID:6360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,15546573895406510220,2975376414463383043,2097152 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,6173707176724918647,10745954108466596479,2097152 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
    3⤵
    PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5036,i,18105449478728622460,3881797807530524158,2097152 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:9
    3⤵
    PID:6464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5324,i,11954313961405343905,12953724196385170023,2097152 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:15
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,14536495139112373499,16828224362730417083,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,10199711695595468864,5283182473006139356,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7180440190424277989,7478458679558448031,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,7180440190424277989,7478458679558448031,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
    3⤵
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,5412523516715940948,15488388022008788002,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,956821474720651293,5366006702378229056,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,4099820601317897767,953111591196955158,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,10060871813909773572,8324340246746860587,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,14820596655128405293,3278383265910179545,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,17382213547875145736,13514775932615879107,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
    3⤵
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6840,i,7827449972044593999,1269381685900482007,262144 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:7016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9581980352080386774,132651598954272957,524288 --field-trial-handle=2372,i,4293240976876104371,15126449101875569652,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
    3⤵
    PID:2472
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.old_1784338097
  2⤵
  - Views/modifies file attributes
  PID:5392
- C:\Windows\system32\attrib.exe
  "attrib" +h +s C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.old_1784338157
  2⤵
  - Views/modifies file attributes
  PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

95a2068c-d4d3-4b56-a962-f8a99cc843b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95a2068c-d4d3-4b56-a962-f8a99cc843b0.tmp
Size 649B
SHA256 8b07f2da5ba12215a33157ab4cf2a68b130c370651653a665c3e6db308865f26
MD5 0065016446b6738e436df231014510b0
SHA1 a9475719f00291e603dd32bb9649601e4669aa74
SHA512 33a2363f3c16a5eb247e961d3926b130b11848fbef685d18a05ddc1a43900f8d621e95bdebc8605814150784be9fc3d6a05486925109fc82d9f2f00c4c6a4f68
TLSH
T154F0F4AAC921BC3729FD1B1870A41B47EB50132B3B51999B3B3D821C4FB463B868681C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2d0b676e85970b441e713aa70482f85e0befce8cd2065f8b8b13251e69260fce
MD5 8cf972280bc9b969cb45522196bda4ec
SHA1 e60be1c50e40e3be1400873f1c492ada6a6f643a
SHA512 189e64d34f5e238ed95f6b4dd9d0bdd7334bb88c6b276344a18695281f695b7c9c77c460baa61a22f2b6879f871cb0603393a5599cfbd82b83679790a1c8491d
TLSH
T1756151A0036B6EF2D76142B23DFDAE6932388C69074F1FE6D154D17664EE72811E1E50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f16b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f16b.TMP
Size 3KB
SHA256 36c6a745c035f39c86c6d282a1913be05f339f8151f64b8ca9db47bbce593584
MD5 a1398186405b9b3e7fff979ed28a3e0c
SHA1 5b8ee1b472c315f490dc74b8764bf7cdcf4438fa
SHA512 78b54103fdad38fe36e0b249f14c4010cc5f189f9d7ccc2c2c441f68d1ba21320f5b67c7f400cba01d690f4a5f8927fcae39c4200298fe02fedf9e68e72915be
TLSH
T10F615EA003AB6EF1D36086B23DFDAE6832348C69174F2EE6D140D17695EE72852F1D11
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02413f3a605886f2b896b9f58ea5a275a6e2549fbf005fa380ced81d48a25c2b
MD5 b503fde68a1d9fff6dac1982cf14cec8
SHA1 274b024c594c501896621053493599677cd31246
SHA512 b384ac9a64b5e6516205368ec9bbb6a45d193e2540c38dd739d4a8e97e9c12f256d6178072abcecb750d6d7cee750feda349c2892ff8273deccefb43d1b99def
TLSH
T19E41C0F383E4856EC90195F0AB187E2BCE1D0915432C3D5AC9E0AF1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 adc3caed247405f5eb7260c767f368881a13a6507fc4e2d233bd24a62ea611dc
MD5 3992451751047714f1d5b67df490f3b2
SHA1 c634552c21a2ec5e7baf6f9d342f04e83aae7255
SHA512 4ea70e2eeef05b83abb7a64596037d1fdfdcd980a70f98b04b0e85632a6cf2979dd4bf177b8abcab174e6afc8e5462df9765c3d12cf20bf5e306e509c90aaab2
SSDEEP 384:sxRY9qfw/fQsLfN/RIalK/5IW4oOgsGQmiB:ssMfw/fH1Wp/5IW42sGQz
TLSH
T11D72EA1666289977DCCBD219FA957F93D2F91173A1905E44AAFCCB0C00EB6ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 eefb883dc9358ff6811faaa155b8950f3fab5cf1f23fd4c30243492c77d6de86
MD5 b811a8cd6c4145ae02d1ad29df3a8d48
SHA1 2a9a57af691c1b713a9966049b7a5cd3baf71525
SHA512 df28228870fa072a7297a0e4ffb7d7575a2e8adb5cbce8a8ce20fe889b4fb66175bb0709b71e5aaa1ab7cf0d32dfd15f5a5e9cc1c652f2ba4192c6c42ce409af
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKobbDwzrob4a:Ob4YZnE7yTWg1NfwBu1jaxobHwA8a
TLSH
T121E2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a77b58c7573b00da2473f80e14eba9971f92a9a939656765809c6a0cbf742f68
MD5 c4616c9aaa1e25ea588f504573f50fd8
SHA1 357f0c0393365fe976ec734e834b33d994861668
SHA512 15b2e2494abe06f1d204b18c4be7aee90e01a037812b9b325997965de791c413224b7ee62895ef55fb959002471ab20797d8e21e1d7afe23b67771d1161ffc51
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9X5L:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRg
TLSH
T13BB24B11753F4680387EB90C91B8982F86C2B4637519E52F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af0fbbe7-b11f-4fd0-8213-bb7f9e84b05d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af0fbbe7-b11f-4fd0-8213-bb7f9e84b05d.tmp
Size 15KB
SHA256 9378950e4dd1348795d317085ea62a3a059ae529cb382fd571931fdd80d5b453
MD5 8e2fc6082b9fa4ac04db11d951c5865b
SHA1 d3ba553dd8757e1bdd58311c90e203476fd6ccf4
SHA512 64c1b9dc9ad12a64de4c7b94e5b0d851b4906c561181ac179e7c504359b759b0c36f6cd9d945fea2e4a24fd50032bff48df0c743d1da5c8aef5c4b41953ef569
SSDEEP 384:sxRY98w/fQs1BN/RIalK/5IW4NOgsGQmjF:ssSw/f5TWp/5IW4NsGQ+
TLSH
T15F72EA166A289D77DCCBD219FA557F93D6FD1133A1905E44AAFCCA0C04E66ED210381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 27227e4674469ab487c1381b8360263edf7c92403007c635753e3777716c24e5
MD5 d8b3c46a18eebb1a256b1111a7906763
SHA1 e319bf0e01e9d9fef5db55c464d9a430d1a4f65d
SHA512 45c2e62a58b5e8f90d5f4bab10c22ff566cd74db298ada40e1daf6ba7c742c8b92877ec212d0b37663b6ca819a0fc5b1f70a85d93ceb6326bf7d834758fa6785
SSDEEP 384:nAiF1tNn/s3n9Su8NLD8TUNTUlIR8PvuTGIBEqfbzGwwjNJ40hOObjI9G6w7MU86:bF1j+9LQDwg+u/HGxD7h29M3
TLSH
T195D24C36D855CE77ECEB4EA9B35A7696EEE0117389CC5A88E5C85E4C00CB1DE0B07C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2a9f8669d1eede27b62f97f7be7756ecff18af9ca6c56b7a8ea3a6eb4de78e41
MD5 1333e4250b0181e60e381ffd2593a1b5
SHA1 2bbbb4c26e3757f1b395af709a07cea4d443228e
SHA512 1e7e2c47fc52643486993ee9505260ead5f8383c081cb6562586cf2a6b61eaff09c12146eea3966536e080f8067da434a7bb33e895857985a67c1e3b6a14ce5f
SSDEEP 384:nViF1tNn/s3n9Sn8Ngb8TUNTUlIRiPvuTu6REqfbzGwwjNULUOObjI9G6w7vw8LE:cF1j+9SXbwgUuFXGxMU29MI
TLSH
T1ECC25A36D865CEB7EDE68FD9A34A7A06EEE0116785DC5AC4EAC81D0D00C71DD070382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 30b3f39a6408df7367568989fd6d96ed2bf1f4705b1f679cea2bb329c0109ef7
MD5 e1522af51949d3d7251092a397a7c2e0
SHA1 f370ac1c1df4a9c6ba996420386ba4cc11672921
SHA512 c0baf4b52d23ffed3a80dfcfafff07a0ae9bb07f55be98e881fe3ce2c47902a43b907d2e36226b5979c76ba4a6a1ff24390015a9992969a0af4f89df14e73c73
SSDEEP 384:nyiF1tNn/s3n9SC8NLD8TUNTUlIR8PvuTGIBEqfbzGwwjNJ8UhOObjI9G6w7MU86:5F1j+9/QDwg+u/HGxDDh29M3
TLSH
T180D24C36D855CE77ECEB4EA9B35A7696EEE0117389CC5A88E5C85E4C00CB1DE0B07C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6a77b9c9faf716f1cc140e849f722dba531f0b83ee6085b0f98343b12b45e553
MD5 5e890ce15c9e04ec4aa201327ffbddc9
SHA1 fd1d44c71ec1a0677835d2c424820ef78aadbcdd
SHA512 2be4a73fcbfa8de08bdd915feb4e2696b4e6d38db5fa1429c6ee1293df4d09a95a794bfd28d626d9c089657802f34a868a6f98971b7e97c85813452f8a5c3a5e
SSDEEP 384:nNiF1tNn/s3n9Su8NLD8TUNTUlIROPvuTDIBEqfbzGwwjNJ8khJiZAK8LEEIzDl:EF1j+9DQDwg0uAHGxD1hJV8
TLSH
T1B7B23B36D865CE77ECEA8FD9A74A7686DEE0116388C85AD8D5C85D4D00CB1DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 d08cc2f063a71566eea46cce811b7da434a9a700a3892b1e013ba690de0fd610
MD5 bc7f5006b973fcdf4aeb8cf00c37f06f
SHA1 e72d9f16083f7d27403ad97a3d57655fcf8e145b
SHA512 ae4de683201eedbb85196eb6be3072246b77baa5824f1805211c2134f415141525f6fa0c1147c72708015725b1fec1848a0d333afc36fd21fe8c74c7843005b9
TLSH
T1F25141E08C381AD1D4BE0A3EB48734FC85E8D725F4A0343D7858EA985A7971D718087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ba2c39a656791f671b81af4ec36117623ee13b48747095d1b5a925851abaac08
MD5 27d8a4e08cd9068dc92fb2f8d31a206c
SHA1 df3048300f9b51d93e4bf6949b67623b4c3cb30f
SHA512 7dca6dde2b979b2587d942ad00a4b2402b27c084414842cb62ebdc83cb77bcbbe0895b8408667d9b44abc932ad34e48cb106359dd1c52dbd9d85c2f55cc6c858
TLSH
T1A95140E08C381AD1D4BD0A7EB48B34FC85ECD726F89038397858EA985A7971D318087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7df8d2842c85314b897197633ab5c962cae2a272dc9151e36388378b0e8ca5c3
MD5 1149543a7c2a9323ee6420870a569cc8
SHA1 6c06392f30b806ff75b28a8509d10a470d453b5e
SHA512 9d594180a7e83b9683172ff0f1d138d14a25bff1b356771f594c98616c62042a6e6d6ecfb70acd2d6e8141a29c7019f13bad4189280a06528694b1b90a7d205f
TLSH
T1EA513FE08C381AD1D4BD1A7EB09B34FC95E8D726F490383D6858EA985A7971D318087F
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.exe
Size 2.7MB
SHA256 862efa10248e3a103bd9969fed4cb80a603f36798be7f6f9d6155c5360a14b9c
MD5 df467d203efaa74ac16005b7c2fb14bb
SHA1 97c821727ea99a36009f6f881484aef73a567644
SHA512 909ef591049b928437978ce16e3dccd201f30692f80015497cf700d6cd3b0679daf1051b07d66c63ade6bbd1de8dede149d16b24d90edda72958056278563a12
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3L:CebAjOKn3wRKRJ3L
TLSH
T17DD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.old_1784338097

Path C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5e79ebf66ad740156da54a461b082fb_akira_glassworm_rusty-stealer.old_1784338097
Size 2.7MB
SHA256 ee7ae0731831777673e564265e76cf08807b810513b210e011b1057be5b689f0
MD5 aee3571380be094c168c6f17a084b283
SHA1 4e03cb0c9870a9b3211e6b1e9b7100bff32782c1
SHA512 7ba28473c5025909dd10940eeb43e27367a0ef30af557de036f98c7c29f68e4a74c229f4f1aadf7cd765b812648139d8f2f6ea7deabe71de9909e56fc0b836de
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3i:CebAjOKn3wRKRJ3i
TLSH
T17BD57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Invoice_Update.pdf

Path C:\Users\Admin\AppData\Local\Temp\Invoice_Update.pdf
Size 18KB
SHA256 229defbb0cee6f02673a5cde290d0673e75a0dc31cec43989c8ab2a4eca7e1bb
MD5 da49bbe37855af62a6a8809453d17b83
SHA1 1f59e84376b2acda296b1b431a16e5cd5dfb7da8
SHA512 4aa87ac380cc78375170b08767edac27929fdacceeec84f555dd249239722064388803e675e0ec95c06487cd2c158b83cd768f08d61ee57515e5c52f191f7cd0
SSDEEP 384:yR+GaFCBHN82KGuaUdm60hX98cTJlDxOv3U8+LI4Kiikj2QQr8xnD:++GactEEUOxT1QU8+k4JjE81
TLSH
T1EA829E25D6440C6EF806A501873E79EE4BBDB27336C865C21C3D9E0AC591554F8F3AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

miniwallet.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

notification.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\Notification\notification.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1666086913\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_910700835\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-251-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-223-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-267-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-178-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-299-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-198-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-321-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-266-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-164-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-230-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-937-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-224-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-195-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download

memory/2032-962-0x00007FF63A060000-0x00007FF63A321000-memory.dmp

Download